CVE-2023-22945

Name of the Vulnerable Software and Affected Versions GrowthExperiments extension for MediaWiki versions 1.39 and earlier

Description The issue allows blocked users to enroll as mentors or edit their mentorship-related properties through the "growthmanagementorlist" API endpoint. This affects users blocked in ApiManageMentorList.

Recommendations For versions 1.39 and earlier, as a temporary workaround, consider disabling the growthmanagementorlist API endpoint until a patch is available. Restrict access to the ApiManageMentorList to minimize the risk of exploitation. Avoid using the growthmanagementorlist API endpoint until the issue is resolved.